A hospital official confirmed the death toll and said at least 36 people were also wounded during the attack in the Baghdad al-Jadida neighbourhood.
"They are inside the Zahrat Baghdad mall. When the security forces got too close, they killed three hostages," a police official said.
"We are taking a cautious approach now. We want this attack to end with the lowest possible number of casualties," the official said.
Potent threat: IS bombers kill 12 policemen at Iraq’s military base
He described the mall as a building of four or five floors in a busy commercial area of Baghdad al-Jadida, a populous Shia-majority area on the eastern edge of the Iraqi capital.
A large plume of black smoke could be seen billowing into the sky above the area where the mall is located.
An interior ministry source said an unspecified number of gunmen opened fire in the street after a car bomb exploded and briefly clashed with members of the security forces before entering the mall.
The official said the attackers had posted men on the roof.
Iraqi army prepares for final push to take Ramadi from Islamic State
One police official suggested there may have been more than one car bomb blast in the early stages of the attack.
Police said a counter-terrorism force from the intelligence services was on the scene and snipers posted on buildings around the mall.
"The attackers at one stage released at least nine hostages, women and children," the police colonel said.
There was no immediate claim of responsibility for the attack but a police source described the gunmen as "wearing Daesh-style clothes".
Iraq probes coalition strike that killed 10 soldiers
The spokesperson for Baghdad Operations Command, Saad Maan, claimed the attack was over and the security forces "in full control of the situation" but other security sources insisted the standoff was ongoing.
"There is a major security deployment around the scene of the attack. Most of the main roads in this part of Baghdad have been closed," the police colonel said.
IS claims deadly Baghdad mall attack
The Islamic State group claimed responsibility for the attack.
The extremist group said in an online statement that four of its members carried out the attack and claimed that as many as 90 people were killed or wounded.
COMMENTS (1)
Comments are moderated and generally will be posted if they are on-topic and not abusive.
For more information, please see our Comments FAQ